CN108023768B - Network event chain establishment method and network event chain establish system - Google Patents
Network event chain establishment method and network event chain establish system Download PDFInfo
- Publication number
- CN108023768B CN108023768B CN201711251630.6A CN201711251630A CN108023768B CN 108023768 B CN108023768 B CN 108023768B CN 201711251630 A CN201711251630 A CN 201711251630A CN 108023768 B CN108023768 B CN 108023768B
- Authority
- CN
- China
- Prior art keywords
- event
- network
- user
- degree
- class
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 238000000034 method Methods 0.000 title claims abstract description 39
- 238000004821 distillation Methods 0.000 claims description 6
- 238000005516 engineering process Methods 0.000 abstract description 2
- 238000004458 analytical method Methods 0.000 description 8
- 238000010586 diagram Methods 0.000 description 5
- 230000000694 effects Effects 0.000 description 5
- 229920000877 Melamine resin Polymers 0.000 description 4
- 230000005540 biological transmission Effects 0.000 description 4
- JDSHMPZPIAZGSV-UHFFFAOYSA-N melamine Chemical compound NC1=NC(N)=NC(N)=N1 JDSHMPZPIAZGSV-UHFFFAOYSA-N 0.000 description 4
- 238000000855 fermentation Methods 0.000 description 3
- 230000004151 fermentation Effects 0.000 description 3
- 238000012545 processing Methods 0.000 description 3
- 235000013305 food Nutrition 0.000 description 2
- 230000009191 jumping Effects 0.000 description 2
- 239000008267 milk Substances 0.000 description 2
- 210000004080 milk Anatomy 0.000 description 2
- 235000013336 milk Nutrition 0.000 description 2
- 238000012986 modification Methods 0.000 description 2
- 230000004048 modification Effects 0.000 description 2
- 241001269238 Data Species 0.000 description 1
- 235000008694 Humulus lupulus Nutrition 0.000 description 1
- 230000002776 aggregation Effects 0.000 description 1
- 238000004220 aggregation Methods 0.000 description 1
- 238000013459 approach Methods 0.000 description 1
- 230000009286 beneficial effect Effects 0.000 description 1
- 210000001520 comb Anatomy 0.000 description 1
- 230000007812 deficiency Effects 0.000 description 1
- 230000001419 dependent effect Effects 0.000 description 1
- 238000011161 development Methods 0.000 description 1
- 238000006073 displacement reaction Methods 0.000 description 1
- 238000001914 filtration Methods 0.000 description 1
- 230000004927 fusion Effects 0.000 description 1
- 230000010354 integration Effects 0.000 description 1
- 238000011835 investigation Methods 0.000 description 1
- 239000000463 material Substances 0.000 description 1
- 238000003672 processing method Methods 0.000 description 1
- 230000001737 promoting effect Effects 0.000 description 1
- 230000000644 propagated effect Effects 0.000 description 1
- 238000012954 risk control Methods 0.000 description 1
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/14—Network analysis or design
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/90—Details of database functions independent of the retrieved data types
- G06F16/95—Retrieval from the web
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/90—Details of database functions independent of the retrieved data types
- G06F16/95—Retrieval from the web
- G06F16/955—Retrieval from the web using information identifiers, e.g. uniform resource locators [URL]
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/14—Network analysis or design
- H04L41/147—Network analysis or design for predicting network behaviour
Landscapes
- Engineering & Computer Science (AREA)
- Databases & Information Systems (AREA)
- Theoretical Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Data Mining & Analysis (AREA)
- Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
Abstract
The invention belongs to information technology fields, and in particular to a kind of network event chain establishment method and network event chain establish system.The network event chain establishment method is comprising steps of acquisition includes user identifier, website, flow, time, duration, the content network data containing keyword；Classify to collected network data, is divided into including at least event class, website class, the classification of user class；The event class, the website class, the network data of the user class are converged, the user-association degree of network data in the event correlation degree and the user class of network data in the website class is calculated separately；According to the event correlation degree, the user-association degree and setting network business, network event chain relevant to setting network business is established.The network event chain establishment method and network event chain establish system, and realization is effectively tracked and predicts to network event relation chain, to achieve the purpose that public sentiment risk profile and tracking.
Description
Technical field
The invention belongs to information technology fields, and in particular to a kind of network event chain establishment method and network event chain are established
System.
Background technique
In the current information age, internet high speed development, it is convenient and conveniently on the one hand to bring for people；On the other hand
Also there are many criminals to be engaged in a large amount of unlawful activities using network, influence social stability.How to carry out risk profile, prevent in
Possible trouble becomes the key for promoting internet security.Government department and business unit are when carrying out public sentiment risk control, public sentiment risk
Prediction becomes important means.And the key point of public sentiment risk profile is to find network unlawful interests chain and illegal transmissions chain
Detecting.
Traditional public sentiment risk profile mode is investigated and prosecuted using the method tracked afterwards after going wrong,
Illegal relationship chain is gradually combed during investigation, there are the following problems for this mode:
It due to being to comb afterwards, can not find, so that look-ahead can not be carried out to illegal event, chop off in advance in advance
Unlawful interests chain, prevents trouble before it happens；
It in the case where interests chain is numerous, can not find in time, cause the illegal event occurred very much, but can be effective
The illegal event of processing is seldom；
Even if employing each side's relationship, still inevitably there is dependent event and comb incomplete situation, be difficult boundless and indistinct
Association includes the overall network link in illegal event relation chain in network.
As it can be seen that how effectively network event relation chain to be tracked and be predicted, thus reach public sentiment risk profile and
The purpose of tracking becomes the important technical problem of current network security urgently to be resolved.
Summary of the invention
The technical problem to be solved by the present invention is to it is true to provide a kind of network event chain for above-mentioned deficiency in the prior art
Cube method and network event chain establish system, and realization is effectively tracked and predicts to network event relation chain, to reach
The purpose of public sentiment risk profile and tracking.
Solving technical solution used by present invention problem is the network event chain establishment method, comprising steps of
Acquisition includes user identifier, website, flow, time, duration, the content network data containing keyword；
Classify to collected network data, is divided into including at least event class, website class, the classification of user class；
The event class, the website class, the network data of the user class are converged, net in the website class is calculated separately
The user-association degree of network data in the event correlation degree and the user class of network data；
According to the event correlation degree, the user-association degree and setting network business, established and setting network business
Relevant network event chain.
Preferably, in the step of classifying to collected network data, comprising:
According to the classification of setting network business or Event Distillation condition code, establishes the event including multiple described document informations and tie up
Spend data template；
It calculates search engine and jumps record, set up a web site dimension data template, and the website dimension data template is at least wrapped
It includes network service, the position that condition code is generated in network service, jump to this website from search engine or other Web portals
Total flow caused by number and event sets；
It integrates event dimension data and website dimension data and user's dimension data template is established according to network user identifier,
Person identifier, website logo, personal visit website event column purpose statistical number are included at least in user's dimension data template
And the flow generated in corresponding website.
Preferably, calculating the step of event correlation of network data is spent in the class of website includes:
Determine event correlation degree level quantity；
Statistics coordinate system is established, it will be in all site maps to coordinate system relevant to event；
A point identical as event correlation degree level quantity is randomly selected as mass center, calculates all the points to each of each mass center
From square of distance, ownership class of the smallest mass center as the point in selected distance value, so that all the points are divided into event correlation
Spend the level quantity degree of association；
New mass center of the coordinate central point as each degree of association in each degree of association is chosen, and calculates all the points to new matter
The distance of the heart, iteration obtain the event correlation degree of network data in event class.
Preferably, calculating the step of user-association of network data is spent in the class of website includes:
Determine user-association degree level quantity；
Statistics coordinate system is established, all users relevant to event are mapped in coordinate system；
A point identical as user-association degree level quantity is randomly selected as mass center, calculates all the points to each of each mass center
From square of distance, ownership class of the smallest mass center as the point in selected distance value, so that all the points are divided into user-association
Spend the level quantity degree of association；
New mass center of the coordinate central point as each degree of association in each degree of association is chosen, and calculates all the points to new matter
The distance of the heart, iteration obtain the user-association degree of network data in event class.
Preferably, the step of establishment network event chain relevant to setting network business includes:
According to the tightness degree of user identifier and the event correlation degree and the user-association degree, to the setting network
Business carries out permutation and combination according to user identifier and the tightness degree of the event correlation degree and the user-association degree, establishes thing
Part association, to establish network event relation chain relevant to the setting network business.
A kind of network event chain establishment system, including acquisition module, categorization module, convergence relating module and establishment module,
Wherein:
The acquisition module, for acquire include user identifier, website, flow, the time, duration, containing the content of keyword
Network data；
The categorization module is divided into for classifying to collected network data including at least event class, website
Class, the classification of user class；
The convergence relating module, for converging the event class, the website class, the network data of the user class,
Calculate separately the user-association degree of network data in the event correlation degree and the user class of network data in the website class；
The established module is used for according to the event correlation degree, the user-association degree and setting network business, really
Found network event chain relevant to setting network business.
Preferably, it in the categorization module, loads and executes following procedure:
According to the classification of setting network business or Event Distillation condition code, establishes the event including multiple described document informations and tie up
Spend data template；
It calculates search engine and jumps record, set up a web site dimension data template, and the website dimension data template is at least wrapped
It includes network service, the position that condition code is generated in network service, jump to this website from search engine or other Web portals
Total flow caused by number and event sets；
It integrates event dimension data and website dimension data and user's dimension data template is established according to network user identifier,
Person identifier, website logo, personal visit website event column purpose statistical number are included at least in user's dimension data template
And the flow generated in corresponding website.
Preferably, the convergence relating module includes event correlation degree unit, and the event correlation degree unit load is simultaneously
Execute following procedure:
Determine event correlation degree level quantity；
Statistics coordinate system is established, it will be in all site maps to coordinate system relevant to event；
A point identical as event correlation degree level quantity is randomly selected as mass center, calculates all the points to each of each mass center
From square of distance, ownership class of the smallest mass center as the point in selected distance value, so that all the points are divided into event correlation
Spend the level quantity degree of association；
New mass center of the coordinate central point as each degree of association in each degree of association is chosen, and calculates all the points to new matter
The distance of the heart, iteration obtain the event correlation degree of network data in event class.
Preferably, the convergence relating module includes user-association degree unit, and the user-association degree unit load is simultaneously
Execute following procedure:
Determine user-association degree level quantity；
Statistics coordinate system is established, all users relevant to event are mapped in coordinate system；
A point identical as user-association degree level quantity is randomly selected as mass center, calculates all the points to each of each mass center
From square of distance, ownership class of the smallest mass center as the point in selected distance value, so that all the points are divided into user-association
Spend the level quantity degree of association；
New mass center of the coordinate central point as each degree of association in each degree of association is chosen, and calculates all the points to new matter
The distance of the heart, iteration obtain the user-association degree of network data in event class.
Preferably, it in the established module, loads and executes following procedure:
According to the tightness degree of user identifier and the event correlation degree and the user-association degree, to the setting network
Business carries out permutation and combination according to user identifier and the tightness degree of the event correlation degree and the user-association degree, establishes thing
Part association, to establish network event relation chain relevant to the setting network business.
The beneficial effects of the present invention are: the present invention provides a kind of network event chain establishment method and its network event chain is established
System excavates the network behavior of user by big data depth, and by establishing drafting to network event chain, network event user chases after
Track is classified, the tracking of network event route of transmission is classified and etc., so that behavior association and analysis are carried out according to network security policy,
Unlawful interests chain is inferred and combed according to the commodity network behavior of user, it is more quasi- convenient for being carried out to network event and its wind direction
True prediction guarantees network security to achieve the purpose that public sentiment risk profile and tracking.
Detailed description of the invention
Fig. 1 is the flow chart of network event chain establishment method in the embodiment of the present invention；
Fig. 2 is the structural block diagram that network event chain establishes system in the embodiment of the present invention；
Fig. 3 is that the network that network event chain establishes system in the embodiment of the present invention disposes schematic diagram；
In attached drawing mark:
1- acquisition module；2- categorization module；3- converges relating module；4- establishes module.
Specific embodiment
Technical solution in order to enable those skilled in the art to better understand the present invention, with reference to the accompanying drawing and specific embodiment party
Formula is established system to inventive network event chain establishment method and network event chain and is described in further detail.
The technical concept of network event chain establishment method of the invention are as follows: since website (containing various network services) is network
The unique passage of upper user or network event fermentation or propagation, therefore to network event or the hot spot that may occur, critical incident
Relation chain be tracked the essence of prediction, personnel and its network activity range that exactly event may relate to and track into
Row tracking and prediction to highlight the protrusion node of network event, and then carry out network event to establish interrelated and combing.
Inventive network event chain establishment method and network event chain establish system, realize and effectively close to network event
Tethers is tracked and predicts, to achieve the purpose that public sentiment risk profile and tracking.
As shown in Figure 1, the network event chain establishment method comprising steps of
Step S1): acquisition includes user identifier, website, flow, time, duration, the content network data containing keyword.
Step S2): classify to collected network data, is divided into including at least event class, website class, user class
Classification.
In this step, carrying out classification to collected network data includes:
According to the classification of setting network business or Event Distillation condition code, the event number of dimensions including multiple condition codes is established
According to template；
It calculates search engine and jumps record, set up a web site dimension data template, and website dimension data template includes at least net
The position of condition code is generated in network business, network service, the number of this website is jumped to from search engine or other Web portals
And total flow caused by event sets；
It integrates event dimension data and website dimension data and user's dimension data template is established according to network user identifier,
In user's dimension data template include at least person identifier, website logo, personal visit website event column purpose statistical number and
In the flow that corresponding website generates.
Step S3): convergence event class, website class, the network data of user class calculate separately network data in the class of website
The user-association degree of network data in event correlation degree and user class.
In this step, the event correlation degree of network data includes: in calculating website class
Firstly, determining event correlation degree level quantity；
Statistics coordinate system is established, it will be in all site maps to coordinate system relevant to event；
A point identical as event correlation degree level quantity is randomly selected as mass center, calculates all the points to each of each mass center
From square of distance, ownership class of the smallest mass center as the point in selected distance value, so that all the points are divided into event correlation
Spend the level quantity degree of association；
New mass center of the coordinate central point as each degree of association in each degree of association is chosen, and calculates all the points to new matter
The distance of the heart, iteration obtain the event correlation degree of network data in event class.
Then, the user-association degree of network data includes: in calculating website class
Determine user-association degree level quantity；
Statistics coordinate system is established, all users relevant to event are mapped in coordinate system；
A point identical as user-association degree level quantity is randomly selected as mass center, calculates all the points to each of each mass center
From square of distance, ownership class of the smallest mass center as the point in selected distance value, so that all the points are divided into user-association
Spend the level quantity degree of association；
New mass center of the coordinate central point as each degree of association in each degree of association is chosen, and calculates all the points to new matter
The distance of the heart, iteration obtain the user-association degree of network data in event class.
Step S4): according to event correlation degree, user-association degree and setting network business, established and setting network business
Relevant network event chain.
In step, establishing network event chain relevant to setting network business includes:
According to the tightness degree of user identifier and event correlation degree and user-association degree, to setting network business according to user
Mark carries out permutation and combination with the tightness degree of event correlation degree and user-association degree, establishes event correlation, to establish and set
Determine the relevant network event chain of network service.
Correspondingly, it is illustrated in figure 2 the structural block diagram that network event chain in the present embodiment establishes system, the network event chain
The system of establishment includes acquisition module 1, categorization module 2, convergence relating module 3 and establishes module 4, in which:
Acquisition module 1, for acquire include user identifier, website, flow, the time, duration, containing the content network of keyword
Data.
Categorization module 2, for classifying to collected network data, be divided into including at least event class, website class,
The classification of user class.
Preferably, it in categorization module 2, loads and executes following procedure:
According to the classification of setting network business or Event Distillation condition code, the event number of dimensions including multiple condition codes is established
According to template；
It calculates search engine and jumps record, set up a web site dimension data template, and website dimension data template includes at least net
The position of condition code is generated in network business, network service, the number of this website is jumped to from search engine or other Web portals
And total flow caused by event sets；
It integrates event dimension data and website dimension data and user's dimension data template is established according to network user identifier,
In user's dimension data template include at least person identifier, website logo, personal visit website event column purpose statistical number and
In the flow that corresponding website generates.
Convergence relating module 3 calculates separately in the class of website for converging event class, website class, the network data of user class
The user-association degree of network data in the event correlation degree and user class of network data.
Preferably, convergence relating module 3 includes event correlation degree unit and user-association degree unit.Wherein, event is closed
Connection degree unit loads and executes following procedure:
Determine event correlation degree level quantity；
Statistics coordinate system is established, it will be in all site maps to coordinate system relevant to event；
A point identical as event correlation degree level quantity is randomly selected as mass center, calculates all the points to each of each mass center
From square of distance, ownership class of the smallest mass center as the point in selected distance value, so that all the points are divided into event correlation
Spend the level quantity degree of association；
New mass center of the coordinate central point as each degree of association in each degree of association is chosen, and calculates all the points to new matter
The distance of the heart, iteration obtain the event correlation degree of network data in event class.
User-association degree unit loads and executes following procedure:
Determine user-association degree level quantity；
Statistics coordinate system is established, all users relevant to event are mapped in coordinate system；
A point identical as user-association degree level quantity is randomly selected as mass center, calculates all the points to each of each mass center
From square of distance, ownership class of the smallest mass center as the point in selected distance value, so that all the points are divided into user-association
Spend the level quantity degree of association；
New mass center of the coordinate central point as each degree of association in each degree of association is chosen, and calculates all the points to new matter
The distance of the heart, iteration obtain the user-association degree of network data in event class.
Module 4 is established, for according to event correlation degree, user-association degree and setting network business, establishing and setting net
The relevant network event chain of network business.
Preferably, it in establishing module 4, loads and executes following procedure:
According to the tightness degree of user identifier and event correlation degree and user-association degree, to setting network business according to user
Mark carries out permutation and combination with the tightness degree of event correlation degree and user-association degree, establishes event correlation, to establish and set
Determine the relevant network event chain of network service.
Below by the network event chain establishment method and network event chain establishment system in the fusion present invention, detailed description pair
The mode that network event chain is established.
Firstly, acquisition module 1 execute step S1) program.Network data is acquired as original number by acquisition module 1
According to the basis predicted as analysis.The data type of acquisition include: user identifier (cell-phone number, IP), network address, flow, the time,
The initial data such as duration, content containing keyword.Network data acquisition module 1 is arranged in each mobile network of operator and fixed network
Network egress carry out data acquisition and because network switch requires away these outlets get to user terminal.This
In, network data is normally stored in database.
Categorization module 2 is connect with acquisition module 1, and categorization module 2 executes step S2) program, for collected net
Network data are classified.The present embodiment is classified according to three dimension network datas, and three dimensions are event class, website respectively
Class, user class.Wherein, event class refers to the condition code extracted according to certain class or some network event, such as: condition code is
The keyword set that event is related to, such as melamine, the keyword that this condition code is related to include food safety, milk safety
Deng, these keywords key1, key2 ... are indicated, therefore event dimension data template is EventID (key1, key2 ...),
The definition of keyword and network event is determined by specific network strategy.Under normal conditions, network strategy is the behavior of people, according to
Focus difference formulates different strategies, such as tracking melamine event fermentation, network strategy simple example are that can lock
Keyword: food safety, milk safety, melamine etc., locking network service are microblogging forwarding, network forum, QQ theme group.
Website class be according to the event dimension data template EventID of event class defined above, according to website (URL or
The networks such as domain name unique identifier), by filtering, counting the record containing keyword and brought flow summation, and count
It calculates search engine and jumps record.Since website (containing various network services) is user or network event fermentation or propagation on network
Unique passage, therefore counting website is range and the route of transmission that can determine event relation chain.In the network event of the present embodiment
Chain is established in forecasting system, and statistics website dimension mainly includes two key statistics:
First, being (Web portals of user) such as the search engine set being concerned about in network strategy to involved in event sets
The relationship amount (such as keyword) arrived generates the number for jumping to corresponding website, such as: user passes through search engine search key
The number for jumping to corresponding website is clicked afterwards, it is direct in the network of operator since these require to spread through the internet
In acquisition (usually acquired in the exit of the mobile network of operator and fixed network, this for user and website access internet must
Through road), can collect；
Second, to be related to the content of keyword in website and generated flow, these information can analyze website net
Network log obtains.Since there is safety management regulation in current country, web log file is not encrypted and must can be traced to the source, therefore can
Very easily to collect the content for being related to keyword in website and generated flow.
Content and generated flow based on above-mentioned keyword and keyword, finally obtain website dimension data template
For WebID { EventID (key1, key2 ...), UnitID, SearchR, sum, T }, wherein WebID (network service ID) is tool
Volume grid business such as website etc., UnitID is specific subservice or sub- column in network service, that is, generates keyword
Specific location, SearchR are the number that this website is jumped to from search engine or other Web portals being concerned about, sum is event
Total flow caused by gathering, flow is more, and skip displacement is bigger, and the relationship of website and network event is closer thus
User class is i.e. according to network user identifier, that is, cell-phone number or IP address, due in the necessary real name of current national regulation
Net, therefore entity individual can be tracked by cell-phone number and IP address, and then believe according to personal visit record and web log file
Breath establishes the personal relation integration with event.User's dimension data template is that { EventID (key1, key2 ...), WebID are (secondary by ID
Number, sum), T, wherein ID is person identifier, WebID is website logo, number, that is, personal visit website event column purpose statistics
Number (can be obtained) by statistics URL+ source IP or cell-phone number, and sum is the flow generated in corresponding website.Here number and stream
Amount embodies the personal degree of attentiveness to event, and why two magnitudes of statistics number and flow are because some possible people are
Look at, does not send out comment or material, therefore mostly still flow is few for access times.
Relating module 3 is converged, for merging according to the above-mentioned all kinds of collection including event class, website class, user class obtained
The degree of association is established, establishes and predicts in order to subsequent progress network event chain.
By step S1) and step S2), the above-mentioned collected related data of institute is divided into two large divisions: event data
Part and user's online whereabouts part.Wherein: the relevant data of event data portion include: network address, the time, duration, contains flow
The content relevant to user's internet behavior such as keyword；The relevant data in user's online whereabouts part include: cell-phone number, IP, visit
Ask number, mobile phone IME coding, location information, time etc..
Convergence relating module 3 connect with categorization module 2, convergence relating module 3 execution step S3) program, be used for
It states all collected data and carries out Cooperative Analysis, to obtain network event chain.
Wherein, the data of event data portion are analyzed for following first steps, and analysis result forms relevant to event
Event relation chain；The data of user's online whereabouts part correspond to second step analysis, the i.e. event by obtaining to first step
The analysis of relation chain, obtains which user relevant to these event chains has, and to the degree of participation and correlation degree of user
Classify, to establish being associated with for user and event.
Step S31): prediction is tracked to the scope of activities of event relation chain.
In this step, the relationship of several degree of association levels, such as three passes of statistics are counted according to network strategy decision
The relationship of connection degree level, including being closely related, relevant, not close relevant, to the above-mentioned website number of dimensions filtered out
It is counted according to template WebID { EventID (key1, key2 ...), UnitID, SearchR, sum, T }.Here it should be understood that
It is that specific degree of association level quantity is determined according to the granularity that security strategy requires, is not limited to exemplary three layers of the present embodiment.
Specific method are as follows:
Firstly, statistics coordinate system is established, it will be in all site maps to coordinate system relevant to event.In the present embodiment
In, the abscissa of coordinate system is number of hops searchR, and ordinate is event total flow sum, the value of period T, T by
Specific network strategy determines.
Then, three points are randomly selected, is respectively closely related, is related, not close related as mass center, calculating all the points
To square of the distance of three mass centers, formula L12=(x1-x2)2+(y1-y2)2, wherein (x1, y1) is the seat of any mass center
Scale value, (x2, y2) are the coordinate value different from any point of mass center.And so on, point each so respectively with three mass centers
A distance value is calculated to obtain, for these three distance values, ownership class of the smallest mass center as this point in selected distance value, thus
All the points are divided into three degrees of association.Because distance is related to evolution, in view of the numerical value after quadratic sum evolution in size relatively upper one
It causes, therefore the present embodiment is using the square more convenient of distance.
Then, in each degree of association, choosing coordinate central point is the x formed, the average value of y range, as each pass
The new mass center of connection degree, and all the points are calculated to the distance of new mass center, the above process is repeated, the n that iterates (after secondary, can go out
Existing center-of-mass coordinate is stable or fluctuates in an acceptable threshold range, then it is assumed that stablizes, has been classified.According to iteration
Fineness is fixed, and the specific value of n is the number when deviation ratio (such as 0.5%) of the deviation of adjacent iteration twice < required,
It can certainly be according to the actual situation using other magnitudes as the standard for determining n, here without limitation.
By above-mentioned processing, website relevant to event is divided into three degrees of association, be respectively be closely related, be related,
Not close correlation, so that event propagation range and approach can be determined according to network strategy by establishing.
Step S32): prediction is tracked to the scope of activities of customer relationship chain.
In this step, to user's dimension data template ID EventID (key1, key2 ...), WebID (number, sum),
T }, it is counted.Here sum is identical as sum above-mentioned, i.e., advanced behaviour part relation chain tracking carries out customer relationship chain again and chases after
Track.
Firstly, calculating the number of user's Access Events and the flow summation of generation, i.e., to the number in all WebID set
It adds up with sum, then multiplied by two corresponding weights, weight is determined by specific network strategy.Flow summation conduct
One refers to magnitude, is used as measuring this network service to the influence degree of network event.
Then, statistics coordinate system is established, all users relevant to event are mapped in coordinate system.In the present embodiment
In, the coordinate system is respectively using number and flow as abscissa and ordinate, next method and above-mentioned to website number of dimensions
It is identical according to the processing method of template.Such as according to network strategy, user is divided into three degree of association levels, that is, being closely related,
It is relevant, not close relevant.
Then, three points are randomly selected, is respectively closely related, is related, not close related as mass center, calculating all the points
To square of the distance of three mass centers, formula L12=(x1-x2)2+(y1-y2)2, wherein (x1, y1) is the seat of any mass center
Scale value, (x2, y2) are the coordinate value different from any point of mass center.And so on, point each so respectively with three mass centers
A distance value is calculated to obtain, for these three distance values, ownership class of the smallest mass center as this point in selected distance value, thus
All the points are divided into three degrees of association.
Finally, choosing coordinate central point is the x formed, the average value of y range, as each pass in each degree of association
The new mass center of connection degree, and all the points are calculated to the distance of new mass center, the above process is repeated, after the n times that iterate, it may appear that
Center-of-mass coordinate is stable or fluctuates in an acceptable threshold range, then it is assumed that stablizes, has been classified.
By above-mentioned processing, user relevant to event is divided into three degrees of association, be respectively be closely related, be related,
Not close correlation obtains the specific range of three class users whereabouts, to establish user's whereabouts set.
Establish module 4 connect with convergence relating module 3, established module 4 executes step S4) program, for establishing network
Event chain, network event chain is traced to the source and be predicted.
According to step S31) and step S32) classification of the event related web site that finds out and event associated user classification, utilize use
Family and WebID in website and the degree of association (close, related, irrelevant) relationship carry out permutation and combination association according to network strategy.This
In network strategy can be carried out for the tightness degree of user identifier and event correlation degree and user-association degree permutation and combination according to
The tightness degree of user identifier and event correlation degree and user-association degree carries out permutation and combination to business.According to above-mentioned analysis
As a result form event relation chain+customer relationship chain data acquisition system, the comprehensive focus incident comprising corresponding concern and with its phase
The distribution of the participating user of the event chain of the correlating event of pass and each correlating event, so as to find out event relation and
Its scope of activities, route of transmission facilitate network to draw out the map that complete event relation chain is propagated and influences audient
Event handling decision and reply.Such as the public sentiment of tracking network melamine event, security strategy are that emphasis pays close attention to user group
Aggregation, can attempt to network service: forum's comment, microblogging forwarding, QQ theme group are combined, other business can not chase after
Within the scope of track.
It is illustrated in figure 3 the network deployment schematic diagram that network event chain in the embodiment of the present invention establishes system.According to this reality
The structural block diagram that the network event chain in example establishes system is applied, network event chain can be easily established very much and establish mode, realize
Effectively network event relation chain is tracked and is predicted, to achieve the purpose that public sentiment risk profile and tracking.
The present invention provides a kind of network event chain establishment method and its network event chain establishes system, passes through big data depth
The network behavior for excavating user, by establishing drafting, the classification of network event user tracking, network event propagation to network event chain
Road tracking classification and etc., so that behavior association and analysis are carried out according to network security policy, according to the commodity network of user
Behavior infers and combs unlawful interests chain, convenient for more accurately being predicted network event and its wind direction, to reach
The purpose of public sentiment risk profile and tracking guarantees network security.
It is understood that the principle that embodiment of above is intended to be merely illustrative of the present and the exemplary implementation that uses
Mode, however the present invention is not limited thereto.For those skilled in the art, essence of the invention is not being departed from
In the case where mind and essence, various changes and modifications can be made therein, these variations and modifications are also considered as protection scope of the present invention.
Claims (10)
1. a kind of network event chain establishment method, which is characterized in that comprising steps of
Acquisition includes user identifier, website, flow, time, duration, the content network data containing keyword；
Classify to collected network data, is divided into including at least event class, website class, the classification of user class；
The event class, the website class, the network data of the user class are converged, network number in the website class is calculated separately
According to event correlation degree and the user class in network data user-association degree；
According to the event correlation degree, the user-association degree and setting network business, establishment is related to setting network business
Network event chain.
2. network event chain establishment method according to claim 1, which is characterized in that collected network data into
In the step of row classification, comprising:
According to the classification of setting network business or Event Distillation condition code, the event number of dimensions including multiple described document informations is established
According to template；
It calculates search engine and jumps record, set up a web site dimension data template, and the website dimension data template includes at least net
The position of condition code is generated in network business, network service, the number of this website is jumped to from search engine or other Web portals
And total flow caused by event sets；
It integrates event dimension data and website dimension data and user's dimension data template is established according to network user identifier, it is described
In user's dimension data template include at least person identifier, website logo, personal visit website event column purpose statistical number and
In the flow that corresponding website generates.
3. network event chain establishment method according to claim 2, which is characterized in that calculate network data in the class of website
The step of event correlation is spent include:
Determine event correlation degree level quantity；
Statistics coordinate system is established, it will be in all site maps to coordinate system relevant to event；
A point identical as event correlation degree level quantity is randomly selected as mass center, calculate all the points to each mass center it is respective away from
From square, ownership class of the smallest mass center as the point in selected distance value, so that all the points are divided into event correlation degree layer
The sub-quantity degree of association；
New mass center of the coordinate central point as each degree of association in each degree of association is chosen, and calculates all the points to new mass center
Distance, iteration obtain the event correlation degree of network data in the class of website.
4. network event chain establishment method according to claim 3, which is characterized in that calculate network data in user class
The step of user-association is spent include:
Determine user-association degree level quantity；
Statistics coordinate system is established, all users relevant to event are mapped in coordinate system；
A point identical as user-association degree level quantity is randomly selected as mass center, calculate all the points to each mass center it is respective away from
From square, ownership class of the smallest mass center as the point in selected distance value, so that all the points are divided into user-association degree layer
The sub-quantity degree of association；
New mass center of the coordinate central point as each degree of association in each degree of association is chosen, and calculates all the points to new mass center
Distance, iteration obtain the user-association degree of network data in user class.
5. network event chain establishment method according to claim 4, which is characterized in that establishment is related to setting network business
Network event chain the step of include:
According to the tightness degree of user identifier and the event correlation degree and the user-association degree, to the setting network business
Permutation and combination is carried out according to user identifier and the tightness degree of the event correlation degree and the user-association degree, establishes event pass
Connection, to establish network event relation chain relevant to the setting network business.
6. a kind of network event chain establishes system, which is characterized in that including acquisition module, categorization module, convergence relating module and
Establish module, in which:
The acquisition module, for acquire include user identifier, website, flow, the time, duration, containing the content network of keyword
Data；
The categorization module, for classifying to collected network data, be divided into including at least event class, website class,
The classification of user class；
The convergence relating module, for converging the event class, the website class, the network data of the user class, respectively
Calculate the user-association degree of network data in the event correlation degree and the user class of network data in the website class；
The established module, for according to the event correlation degree, the user-association degree and setting network business, establish with
The relevant network event chain of setting network business.
7. network event chain according to claim 6 establishes system, which is characterized in that in the categorization module, load
And execute following procedure:
According to the classification of setting network business or Event Distillation condition code, the event number of dimensions including multiple described document informations is established
According to template；
It calculates search engine and jumps record, set up a web site dimension data template, and the website dimension data template includes at least net
The position of condition code is generated in network business, network service, the number of this website is jumped to from search engine or other Web portals
And total flow caused by event sets；
It integrates event dimension data and website dimension data and user's dimension data template is established according to network user identifier, it is described
In user's dimension data template include at least person identifier, website logo, personal visit website event column purpose statistical number and
In the flow that corresponding website generates.
8. network event chain according to claim 7 establishes system, which is characterized in that the convergence relating module includes thing
Part degree of association unit, the event correlation degree unit load and execute following procedure:
Determine event correlation degree level quantity；
Statistics coordinate system is established, it will be in all site maps to coordinate system relevant to event；
A point identical as event correlation degree level quantity is randomly selected as mass center, calculate all the points to each mass center it is respective away from
From square, ownership class of the smallest mass center as the point in selected distance value, so that all the points are divided into event correlation degree layer
The sub-quantity degree of association；
New mass center of the coordinate central point as each degree of association in each degree of association is chosen, and calculates all the points to new mass center
Distance, iteration obtain the event correlation degree of network data in the class of website.
9. network event chain according to claim 8 establishes system, which is characterized in that the convergence relating module includes using
Family degree of association unit, the user-association degree unit load and execute following procedure:
Determine user-association degree level quantity；
Statistics coordinate system is established, all users relevant to event are mapped in coordinate system；
A point identical as user-association degree level quantity is randomly selected as mass center, calculate all the points to each mass center it is respective away from
From square, ownership class of the smallest mass center as the point in selected distance value, so that all the points are divided into user-association degree layer
The sub-quantity degree of association；
New mass center of the coordinate central point as each degree of association in each degree of association is chosen, and calculates all the points to new mass center
Distance, iteration obtain the user-association degree of network data in user class.
10. network event chain according to claim 9 establishes system, which is characterized in that in the established module, load
And execute following procedure:
According to the tightness degree of user identifier and the event correlation degree and the user-association degree, to the setting network business
Permutation and combination is carried out according to user identifier and the tightness degree of the event correlation degree and the user-association degree, establishes event pass
Connection, to establish network event relation chain relevant to the setting network business.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201711251630.6A CN108023768B (en) | 2017-12-01 | 2017-12-01 | Network event chain establishment method and network event chain establish system |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201711251630.6A CN108023768B (en) | 2017-12-01 | 2017-12-01 | Network event chain establishment method and network event chain establish system |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN108023768A CN108023768A (en) | 2018-05-11 |
| CN108023768B true CN108023768B (en) | 2019-05-10 |
Family
ID=62077952
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201711251630.6A Active CN108023768B (en) | 2017-12-01 | 2017-12-01 | Network event chain establishment method and network event chain establish system |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN108023768B (en) |
Families Citing this family (9)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110737821B (en) * | 2018-07-03 | 2022-06-07 | 百度在线网络技术（北京）有限公司 | Similar event query method, device, storage medium and terminal equipment |
| CN109167781B (en) * | 2018-08-31 | 2021-02-26 | 杭州安恒信息技术股份有限公司 | Network attack chain identification method and device based on dynamic correlation analysis |
| CN109409619A (en) * | 2018-12-19 | 2019-03-01 | 泰康保险集团股份有限公司 | Prediction technique, device, medium and the electronic equipment of public sentiment trend |
| CN109951461B (en) * | 2019-03-07 | 2021-08-17 | 中国联合网络通信集团有限公司 | Information tracing method and device based on wireless network |
| CN112312359A (en) * | 2019-07-23 | 2021-02-02 | 中兴通讯股份有限公司 | Method and device for realizing information association |
| CN110493264B (en) * | 2019-09-18 | 2021-12-24 | 北京工业大学 | Internal threat discovery method based on internal network entity relationship and behavior chain |
| CN110765777B (en) * | 2019-10-17 | 2023-09-15 | 上海大学 | Event correlation degree calculation method based on associated semantic chain network |
| CN113613248B (en) * | 2020-04-20 | 2023-06-16 | 华为技术有限公司 | Authentication event processing method, device and system |
| CN112148979B (en) * | 2020-09-27 | 2023-08-01 | 北京百度网讯科技有限公司 | Event-associated user identification method, device, electronic equipment and storage medium |
Family Cites Families (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US8135693B2 (en) * | 2009-01-21 | 2012-03-13 | Brazier Sandra B | Method for compiling, trend-tracking, transmitting and reporting opinion data |
| CN106815651A (en) * | 2015-11-27 | 2017-06-09 | 亿阳信通股份有限公司 | A kind of social public accident method for prewarning risk and system |
| CN106874365A (en) * | 2016-12-30 | 2017-06-20 | 中国科学院自动化研究所 | Tracking based on social event on Social Media platform |
| CN107329970A (en) * | 2017-05-23 | 2017-11-07 | 成都联宇云安科技有限公司 | A kind of method analyzed and processed for mobile phone managing and control system public sentiment big data |
-
2017
- 2017-12-01 CN CN201711251630.6A patent/CN108023768B/en active Active
Also Published As
| Publication number | Publication date |
|---|---|
| CN108023768A (en) | 2018-05-11 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN108023768B (en) | Network event chain establishment method and network event chain establish system | |
| Blondel et al. | A survey of results on mobile phone datasets analysis | |
| Gambs et al. | De-anonymization attack on geolocated data | |
| Arnaboldi et al. | Dynamics of personal social relationships in online social networks: a study on twitter | |
| Pagani et al. | Resilience or robustness: identifying topological vulnerabilities in rail networks | |
| Nanavati et al. | On the structural properties of massive telecom call graphs: findings and implications | |
| Chen et al. | Differentially private transit data publication: a case study on the montreal transportation system | |
| Nanavati et al. | Analyzing the structure and evolution of massive telecom graphs | |
| Svenson et al. | Social network analysis and information fusion for anti-terrorism | |
| CN102594783A (en) | Network security emergency responding method | |
| Ferrara et al. | The role of strong and weak ties in Facebook: a community structure perspective | |
| WO2014012927A1 (en) | Method and system for traffic estimation | |
| Yeshwanth et al. | Evolutionary churn prediction in mobile networks using hybrid learning | |
| Li et al. | Enhancing telco service quality with big data enabled churn analysis: infrastructure, model, and deployment | |
| Gupta et al. | Malreg: Detecting and analyzing malicious retweeter groups | |
| Zhou et al. | A privacy-based SLA violation detection model for the security of cloud computing | |
| CN110460608A (en) | A kind of Situation Awareness method and system comprising association analysis | |
| Bahulkar et al. | Integrative analytics for detecting and disrupting transnational interdependent criminal smuggling, money, and money-laundering networks | |
| Coscia et al. | Benchmarking api costs of network sampling strategies | |
| Holland | Enabling Open Source Intelligence (OSINT) in private social networks | |
| Kim | Anatomy on malware distribution networks | |
| CN111917718B (en) | Personal information leakage monitoring method and device | |
| Xu et al. | Fraud detection in telecommunication: a rough fuzzy set based approach | |
| Manatova et al. | Building and testing a network of social trust in an underground forum: Robust connections and overlapping criminal domains | |
| Goergen et al. | Identifying abnormal patterns in cellular communication flows |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |